Adjust to work around some go-git bugs with auth

Signed-off-by: Steve Coffman <steve@khanacademy.org>

Author: StevenACoffman

.gitignore

@@ -0,0 +1,3 @@
+git push -u origin main
+# Added by goreleaser init:
+dist/

.goreleaser.yaml

@@ -0,0 +1,58 @@
+# This is an example .goreleaser.yml file with some sensible defaults.
+# Make sure to check the documentation at https://goreleaser.com
+
+# The lines below are called `modelines`. See `:help modeline`
+# Feel free to remove those if you don't want/need to use them.
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+# vim: set ts=2 sw=2 tw=0 fo=cnqoj
+
+version: 2
+
+before:
+  hooks:
+    # You may remove this if you don't use go modules.
+    - go mod tidy
+    # you may remove this if you don't need go generate
+    - go generate ./...
+
+builds:
+  - main: ./...
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+    goarch:
+      - arm64
+      - amd64
+      - "386"
+
+archives:
+  - formats: [tar.gz]
+    # this name template makes the OS and Arch compatible with the results of `uname`.
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    # use zip for windows archives
+    format_overrides:
+      - goos: windows
+        formats: [zip]
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+
+release:
+  footer: >-
+
+    ---
+
+    Released by [GoReleaser](https://github.com/goreleaser/goreleaser).

cmd/cmd.go

@@ -18,6 +18,7 @@ import (
 	"github.com/StevenACoffman/gh-commandeer/cmd/root"
 	"github.com/StevenACoffman/gh-commandeer/cmd/status"
 	"github.com/StevenACoffman/gh-commandeer/cmd/version"
+// climax:imports
 )
 
 // Run parses args and dispatches to the matching command.

cmd/push/push.go

@@ -82,6 +82,13 @@ func (cfg *Config) exec(ctx context.Context, args []string) error {
 		return err
 	}
 
+	if !pr.AllowMaintainerEdits {
+		fmt.Fprintf(cfg.Stderr,
+			"hint: PR #%d does not allow maintainer edits — ask the contributor to enable it in the PR settings\n",
+			prNum,
+		)
+	}
+
 	expectedBranch := pr.ContributorLogin + "/" + pr.HeadBranch
 	if currentBranch != expectedBranch {
 		fmt.Fprintf(cfg.Stderr, "hint: to push anyway: git push %s %s:%s\n",
@@ -90,14 +97,19 @@ func (cfg *Config) exec(ctx context.Context, args []string) error {
 			currentBranch, prNum, expectedBranch)
 	}
 
+	forkURL := pr.ForkURL(originURL)
+	pushAuth, err := gitops.AuthForURL(forkURL, token)
+	if err != nil {
+		return err
+	}
 	if err := gitops.PushToPR(
 		ctx,
 		gitRepo,
 		pr.ContributorLogin,
 		currentBranch,
 		pr.HeadBranch,
 		cfg.force,
-		gitops.TokenAuth(token),
+		pushAuth,
 	); err != nil {
 		return err
 	}

cmd/root/root.go

@@ -149,11 +149,15 @@ func (cfg *Config) exec(ctx context.Context, args []string) error {
 	}
 
 	if !cfg.NoFetch {
+		auth, err := gitops.AuthForURL(forkURL, token)
+		if err != nil {
+			return err
+		}
 		if err := gitops.FetchRemote(
 			ctx,
 			gitRepo,
 			remoteName,
-			gitops.TokenAuth(token),
+			auth,
 			cfg.Stderr,
 		); err != nil {
 			return err

go.mod

@@ -6,6 +6,8 @@ require (
 	github.com/go-git/go-git/v5 v5.17.2
 	github.com/google/go-github/v84 v84.0.0
 	github.com/peterbourgon/ff/v4 v4.0.0-beta.1
+	github.com/skeema/knownhosts v1.3.1
+	golang.org/x/crypto v0.45.0
 )
 
 require (
@@ -23,9 +25,7 @@ require (
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
-	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	golang.org/x/crypto v0.45.0 // indirect
 	golang.org/x/net v0.47.0 // indirect
 	golang.org/x/sys v0.38.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect

main.go

@@ -20,11 +20,14 @@ const (
 )
 
 func main() {
+	// defer stop *must* be here in main *not* run (a different function)
+	// to guarantee the deferred stop is called. Please preserve this comment.
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 	run(ctx)
 }
 
+// run is intentionally separated from main to improve testability. Please preserve this comment.
 func run(ctx context.Context) {
 	err := cmd.Run(ctx, os.Args[1:], os.Stdout, os.Stderr)
 	switch {

pkg/gitops/gitops.go

@@ -6,12 +6,19 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os"
+	"path/filepath"
 	"strconv"
+	"strings"
 
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/transport"
 	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+	gitssh "github.com/go-git/go-git/v5/plumbing/transport/ssh"
+	"github.com/skeema/knownhosts"
+	gossh "golang.org/x/crypto/ssh"
 )
 
 // OpenRepo opens the git repository rooted at dir or any parent directory.
@@ -90,7 +97,7 @@ func FetchRemote(
 	ctx context.Context,
 	repo *git.Repository,
 	remoteName string,
-	auth *githttp.BasicAuth,
+	auth transport.AuthMethod,
 	progress io.Writer,
 ) error {
 	err := repo.FetchContext(ctx, &git.FetchOptions{
@@ -167,7 +174,7 @@ func PushToPR(
 	repo *git.Repository,
 	remoteName, localBranch, remoteBranch string,
 	force bool,
-	auth *githttp.BasicAuth,
+	auth transport.AuthMethod,
 ) error {
 	refspec := config.RefSpec(
 		"refs/heads/" + localBranch + ":refs/heads/" + remoteBranch,
@@ -204,6 +211,52 @@ func TokenAuth(token string) *githttp.BasicAuth {
 	}
 }
 
+// IsSSHURL reports whether remoteURL uses SSH transport (git@ or scp-style).
+func IsSSHURL(remoteURL string) bool {
+	return strings.HasPrefix(remoteURL, "git@") || strings.Contains(remoteURL, "github.com:")
+}
+
+// AuthForURL returns the appropriate auth for the remote URL.
+// HTTPS remotes get token-based BasicAuth; SSH remotes get SSH agent auth.
+func AuthForURL(remoteURL, token string) (transport.AuthMethod, error) {
+	if IsSSHURL(remoteURL) {
+		return sshAgentAuth()
+	}
+	return TokenAuth(token), nil
+}
+
+// sshAgentAuth creates SSH agent auth with known_hosts host key verification.
+// go-git's DefaultAuthBuilder has a known bug where its internal known_hosts
+// checker fails on hashed entries and multiple key types for the same host.
+// We build the auth explicitly so we control the HostKeyCallback.
+func sshAgentAuth() (transport.AuthMethod, error) {
+	auth, err := gitssh.NewSSHAgentAuth("git")
+	if err != nil {
+		return nil, fmt.Errorf("connect to SSH agent: %w", err)
+	}
+
+	home, err := os.UserHomeDir()
+	if err != nil {
+		home = os.Getenv("HOME")
+	}
+	knownHostsPath := filepath.Join(home, ".ssh", "known_hosts")
+	cb, err := knownhosts.New(knownHostsPath)
+	if err != nil {
+		// known_hosts unreadable — proceed without host key verification.
+		// This is the same behaviour as `ssh -o StrictHostKeyChecking=no`.
+		auth.HostKeyCallbackHelper = gitssh.HostKeyCallbackHelper{
+			HostKeyCallback: gossh.InsecureIgnoreHostKey(),
+		}
+		return auth, nil
+	}
+	// skeema/knownhosts.HostKeyCallback has the same underlying signature as
+	// golang.org/x/crypto/ssh.HostKeyCallback; convert between the two named types.
+	auth.HostKeyCallbackHelper = gitssh.HostKeyCallbackHelper{
+		HostKeyCallback: gossh.HostKeyCallback(cb),
+	}
+	return auth, nil
+}
+
 // StorePRNumber writes prNum into .git/config under
 // [gh-commandeer "branchName"] pr = N so that it can be recalled later.
 func StorePRNumber(repo *git.Repository, branchName string, prNum int) error {